CVE-2024-53241: x86/xen: don't do PV iret hypercall through hypercall page
First published: Tue Dec 10 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping to the Xen hypercall page for doing the iret hypercall, directly code the required sequence in xen-asm.S. This is done in preparation of no longer using hypercall page at all, as it has shown to cause problems with speculation mitigations. This is part of XSA-466 / CVE-2024-53241.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/05df6e6cd9a76b778aee33c3c18c9f3b3566d4a5
- https://git.kernel.org/stable/c/82c211ead1ec440dbf81727e17b03b5e3c44b93d
- https://git.kernel.org/stable/c/a2796dff62d6c6bfc5fbebdf2bee0d5ac0438906
- https://git.kernel.org/stable/c/c7b4cfa6213a44fa48714186dfdf125072d036e3
- https://git.kernel.org/stable/c/f7c3fdad0a474062d566aae3289d490d7e702d30
- https://git.kernel.org/stable/c/fa719857f613fed94a79da055b13ca51214c694f
- http://www.openwall.com/lists/oss-security/2024/12/17/2
- http://www.openwall.com/lists/oss-security/2024/12/23/1
- http://www.openwall.com/lists/oss-security/2025/01/05/1
- http://www.openwall.com/lists/oss-security/2025/01/05/2
- http://xenbits.xen.org/xsa/advisory-466.html
- https://access.redhat.com/errata/RHSA-2025:3894
- https://access.redhat.com/errata/RHSA-2025:3893
- https://lore.kernel.org/all/54c892eded2b4ebdda8ee1085c383178f44414ad.camel@infradead.org/
- https://lore.kernel.org/xen-devel/f7b820af-b548-4dc3-9af7-9d2214a232b2@amd.com/T/#u
- https://bugzilla.redhat.com/show_bug.cgi?id=2331326
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-53241
- agent/title
- agent/type
- agent/author
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/severity
- agent/description
- agent/references
- agent/first-publish-date
- agent/event
- agent/trending
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- vendor/linux foundation
- canonical/linux kernel